IBM SevOne CVE-2026-95867

Exploitation requires LOCAL access to the IBM SevOne Network Performance Management host AND pre-existing HIGH privileges on that system (CVSS AV:L, PR:H) - this is a post-authentication, post-access flaw, not a remote or unauthenticated one. The affected versions are 7.0.0 through 8.2.2. The specific product feature, input vector, or component that contains the stack buffer overflow is not described in the available sources; the description states only that a local attacker can trigger a buffer overflow to execute arbitrary code. Limiting factors that reduce real-world risk: the need for local access and high privileges means an attacker must already substantially control or be authorized on the appliance, making this primarily a privilege/impact-amplification issue rather than an initial-access vector. No user interaction is required (UI:N).

This is a moderate-severity, lower-priority issue by real-world signals, not a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U, 6.7 Medium) describes a LOCAL attack requiring HIGH privileges - the attacker must already have privileged access to the SevOne system before the buffer overflow can be reached, which sharply limits exploitability and explains the sub-7.0 score despite full C:H/I:H/A:H impact. KEV status is not present in the input (no confirmed active exploitation), EPSS is not provided (exploitation probability unknown), and no SSVC exploitation/automatable metrics are supplied. The vendor's own priority label is 'this_month', consistent with a serious-but-not-urgent flaw. The only reference is an IBM patch page - no public PoC or exploit code is present, so there is no public exploit identified at time of analysis. The main caveat: exact affected-version boundaries and the fixed version are not restated in the input beyond the 7.0.0-8.2.2 range, so confirm the patched build with IBM advisory node/7289655. Overall: a genuine privilege-escalation/post-compromise code-execution risk for operators of SevOne, but gated behind existing high privileges and local access - prioritize per the vendor's monthly cadence rather than treating it as an internet-facing crisis.

An attacker who already holds high-privilege access on an IBM SevOne NPM appliance (version 7.0.0 through 8.2.2) supplies crafted oversized input to a vulnerable local component, overflowing a stack buffer (CWE-121) to execute arbitrary code in that process's context. Because the CVSS vector is AV:L with PR:H and no user interaction, this is a local, authenticated post-compromise action rather than a remote entry point. No public exploit code is identified at time of analysis.